They're saying they don't trust that the constants defining the curve were chosen non-maliciously. The NSA has, in the past, standardized protocols that contain

They're saying they don't trust that the constants defining the curve were chosen non-maliciously. The NSA has, in the past, standardized protocols that contained intentional backdoors embedded into the constants used in the definition [1]. Because of things like that, it's desirable for cryptographic protocols to use constants chosen in some way that makes backdooring intractable [2]. 1: https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG 2: https://en.wikipedia.org/wiki/Nothing-up-my-sleeve_number https://en.wikipedia.org/wiki/Nothing-up-my-sleeve_number